Do i use the proper extracted data from my encrypted Truecrypt HDD for hashcat?
#4
(01-11-2022, 10:53 AM)Banaanhangwagen Wrote: As explained here https://hashcat.net/wiki/doku.php?id=fre...pt_volumes, you need the first 512 bytes of the encrypted partition.

Code:
dd if=[FILE] of=[OUTPUT] bs=512 count=1

The following tip is pure gold: make a test case. Simply install Truecrypt on your working machine/virtual machine, plug in a small USB, encrypt it with a easy-to-remember-pwd, extract the first 512 bytes and try to crack it.
Take note of what algo/hashing you selected in order to select afterwards with the correct modus.

Try it multiple times, play around. Once you successfully completed all the steps, you get confident, and you can begin cracking the real case.

i think this ist the best aproach. install this old truecryptversion you used back then and just encrypt a small usb-stick, write down which settings are used by default, i think back then they used ripemd-160 before switching to sha

for a normal / wizard driven encrypted partition, hc needs the first sector of that partition NOT the DISK, i use an hexeditor like HXD to extract these under windows, or linux dd

as i see dd for win uses the same options, so 
bs=512 count=1
should do the trick

for the rest i think building up a dictionary with your used passes or phrases (or parts of them) and using some of the external hashcat tools like combinator, combipow to generate combinations of your passes will help, after generating you could combine them even further with rules, but first of all i would starting with building a personalized dict
Reply


Messages In This Thread
RE: Do i use the proper extracted data from my encrypted Truecrypt HDD for hashcat? - by Snoopy - 01-12-2022, 05:33 PM